Frequently asked questions

For a small to mid-sized organisation, typically four to nine months from gap assessment to certificate, depending on how much is already in place and how quickly decisions can be made.

A senior security leader engaged part-time or on retainer. You get strategy, risk management, board reporting and audit ownership without a full-time executive salary.

Yes. Phoebus Group is Sydney-based and works with clients across Australia and the Asia Pacific, remotely and on-site, including regular work in Canberra for government suppliers and with clients in Papua New Guinea.

Preparation for an assessment by an IRAP assessor against the Australian Government Information Security Manual (ISM): mapping controls, closing gaps and assembling evidence so the assessment runs smoothly. We prepare; an independent assessor assesses.

No. ASD has launched Essentials as the successor to the Essential Eight and existing ratings do not carry across. We run the new assessment on the evidence you already hold.

Yes. We review what exists, keep what works, and bring the rest up to the current standard before the next surveillance or recertification audit.

Three ways: a defined project with a fixed scope and price, a retainer for a set number of days a month, or a managed service such as Managed RFFR that keeps you compliant year-round.

A short call to understand what you are being asked to meet (a tender clause, a client questionnaire, an accreditation letter or an audit finding) and what you already have. You get a clear view of the gap and a quote.

We lead and verify. Your IT team or managed service provider implements technical controls; we set the requirements, review the configuration and make sure the evidence stands up.